@datasynx/agentic-ai-cartography 1.1.1 → 2.2.0

package/dist/chunk-2SZ5QHGH.js.map

@@ -0,0 +1 @@
+{"version":3,"sources":["../src/bookmarks.ts","../src/platform.ts","../src/allowlist.ts","../src/logger.ts"],"sourcesContent":["import { tmpdir } from 'node:os';\nimport { existsSync, readFileSync, readdirSync, copyFileSync, statSync, unlinkSync } from 'node:fs';\nimport { join } from 'node:path';\nimport { HOME, IS_WIN, IS_MAC, browserBasePaths, firefoxBaseDirs } from './platform.js';\n\n/**\n * Remove orphaned temp files from previous bookmark/history scans.\n * Call at startup to prevent /tmp accumulation after crashes.\n */\nexport function cleanupTempFiles(): number {\n  let cleaned = 0;\n  const tmp = tmpdir();\n  try {\n    for (const f of readdirSync(tmp)) {\n      if (f.startsWith('cartograph_') && f.endsWith('.sqlite')) {\n        try {\n          unlinkSync(join(tmp, f));\n          cleaned++;\n        } catch { /* file in use or already gone */ }\n      }\n    }\n  } catch { /* tmpdir not readable */ }\n  return cleaned;\n}\n\n// ── Types ─────────────────────────────────────────────────────────────────────\n\nexport interface BookmarkHost {\n  hostname: string;\n  port: number;\n  protocol: 'http' | 'https';\n  source: string;\n}\n\nexport interface HistoryHost extends BookmarkHost {\n  visitCount: number;\n}\n\n// ── Helpers ───────────────────────────────────────────────────────────────────\n\nexport function extractHost(rawUrl: string, source: string): BookmarkHost | null {\n  try {\n    const u = new URL(rawUrl);\n    if (u.protocol !== 'http:' && u.protocol !== 'https:') return null;\n    const protocol = u.protocol === 'https:' ? 'https' as const : 'http' as const;\n    // Strip: no paths, no params, no credentials — hostname only\n    const port = u.port ? parseInt(u.port, 10) : (protocol === 'https' ? 443 : 80);\n    const hostname = u.hostname.toLowerCase();\n    if (!hostname || hostname === 'localhost' || hostname === '127.0.0.1') return null;\n    return { hostname, port, protocol, source };\n  } catch {\n    return null;\n  }\n}\n\n// Chrome/Edge/Brave JSON format\nexport interface ChromeNode {\n  type?: string;\n  url?: string;\n  children?: ChromeNode[];\n}\n\nexport function walkChrome(node: ChromeNode, source: string, out: BookmarkHost[]): void {\n  if (node.type === 'url' && node.url) {\n    const h = extractHost(node.url, source);\n    if (h) out.push(h);\n  }\n  if (node.children) {\n    for (const child of node.children) walkChrome(child, source, out);\n  }\n}\n\nexport function readChromeLike(filePath: string, source: string): BookmarkHost[] {\n  if (!existsSync(filePath)) return [];\n  try {\n    const raw = JSON.parse(readFileSync(filePath, 'utf8')) as {\n      roots: Record<string, ChromeNode>;\n    };\n    const out: BookmarkHost[] = [];\n    for (const root of Object.values(raw.roots)) {\n      if (root) walkChrome(root, source, out);\n    }\n    return out;\n  } catch {\n    return [];\n  }\n}\n\nasync function queryBrowserDb<T>(srcPath: string, tmpPrefix: string, query: string): Promise<T[]> {\n  if (!existsSync(srcPath)) return [];\n  const tmp = join(tmpdir(), `cartograph_${tmpPrefix}_${Date.now()}.sqlite`);\n  try {\n    copyFileSync(srcPath, tmp);\n    const { default: Database } = await import('better-sqlite3');\n    const db = new Database(tmp, { readonly: true, fileMustExist: true });\n    try {\n      return db.prepare(query).all() as T[];\n    } finally {\n      db.close();\n    }\n  } catch {\n    return [];\n  } finally {\n    try { unlinkSync(tmp); } catch { /* ignore */ }\n  }\n}\n\nexport async function readFirefoxBookmarks(profileDir: string): Promise<BookmarkHost[]> {\n  const rows = await queryBrowserDb<{ url: string }>(\n    join(profileDir, 'places.sqlite'), 'ff_bm',\n    `SELECT DISTINCT p.url FROM moz_places p\n     JOIN moz_bookmarks b ON b.fk = p.id\n     WHERE b.type = 1 AND p.url NOT LIKE 'place:%' LIMIT 3000`,\n  );\n  return rows.map(r => extractHost(r.url, 'firefox')).filter((h): h is BookmarkHost => h !== null);\n}\n\nexport async function readFirefoxHistory(profileDir: string): Promise<HistoryHost[]> {\n  const rows = await queryBrowserDb<{ url: string; visit_count: number }>(\n    join(profileDir, 'places.sqlite'), 'ff_hist',\n    `SELECT url, visit_count FROM moz_places\n     WHERE url NOT LIKE 'place:%' AND visit_count > 0\n     ORDER BY visit_count DESC LIMIT 5000`,\n  );\n  return rows\n    .map(r => {\n      const h = extractHost(r.url, 'firefox');\n      return h ? { ...h, visitCount: r.visit_count } : null;\n    })\n    .filter((h): h is HistoryHost => h !== null);\n}\n\nexport async function readChromiumHistory(historyPath: string, source: string): Promise<HistoryHost[]> {\n  const rows = await queryBrowserDb<{ url: string; visit_count: number }>(\n    historyPath, 'ch_hist',\n    `SELECT url, visit_count FROM urls\n     WHERE hidden = 0 AND visit_count > 0\n     ORDER BY visit_count DESC LIMIT 5000`,\n  );\n  return rows\n    .map(r => {\n      const h = extractHost(r.url, source);\n      return h ? { ...h, visitCount: r.visit_count } : null;\n    })\n    .filter((h): h is HistoryHost => h !== null);\n}\n\n// ── Platform paths ────────────────────────────────────────────────────────────\n// Uses centralized platform.ts for Linux/macOS/Windows browser base paths.\n\nconst IS_LINUX = !IS_MAC && !IS_WIN;\n\n// Browser bookmark file paths (multiple profiles supported)\nexport function chromeLikePaths(base: string): string[] {\n  const paths: string[] = [];\n  const defaultPath = join(base, 'Default', 'Bookmarks');\n  if (existsSync(defaultPath)) paths.push(defaultPath);\n  // Also check Profile 1, Profile 2, etc.\n  if (existsSync(base)) {\n    try {\n      for (const entry of readdirSync(base)) {\n        if (entry.startsWith('Profile ')) {\n          const p = join(base, entry, 'Bookmarks');\n          if (existsSync(p)) paths.push(p);\n        }\n      }\n    } catch { /* ignore */ }\n  }\n  return paths;\n}\n\nexport function chromeLikeHistoryPaths(base: string): string[] {\n  const paths: string[] = [];\n  const defaultPath = join(base, 'Default', 'History');\n  if (existsSync(defaultPath)) paths.push(defaultPath);\n  if (existsSync(base)) {\n    try {\n      for (const entry of readdirSync(base)) {\n        if (entry.startsWith('Profile ')) {\n          const p = join(base, entry, 'History');\n          if (existsSync(p)) paths.push(p);\n        }\n      }\n    } catch { /* ignore */ }\n  }\n  return paths;\n}\n\n// Get browser bases from centralized platform module\nconst BROWSER_BASES = browserBasePaths();\n\nconst CHROME_BASE = BROWSER_BASES.chrome;\nconst CHROMIUM_BASE = BROWSER_BASES.chromium;\nconst EDGE_BASE = BROWSER_BASES.edge;\nconst BRAVE_BASE = BROWSER_BASES.brave;\nconst VIVALDI_BASE = BROWSER_BASES.vivaldi;\nconst OPERA_BASE = BROWSER_BASES.opera;\n\n// Snap / Flatpak variants (Linux only)\nconst CHROMIUM_SNAP_BASE = join(HOME, 'snap', 'chromium', 'common', 'chromium');\nconst CHROMIUM_FLATPAK_BASE = join(HOME, '.var', 'app', 'org.chromium.Chromium', 'config', 'chromium');\nconst CHROME_FLATPAK_BASE = join(HOME, '.var', 'app', 'com.google.Chrome', 'config', 'google-chrome');\nconst BRAVE_FLATPAK_BASE = join(HOME, '.var', 'app', 'com.brave.Browser', 'config', 'BraveSoftware', 'Brave-Browser');\nconst EDGE_FLATPAK_BASE = join(HOME, '.var', 'app', 'com.microsoft.Edge', 'config', 'microsoft-edge');\n\nfunction firefoxProfileDirs(): string[] {\n  const bases = firefoxBaseDirs();\n  const dirs: string[] = [];\n  for (const base of bases) {\n    if (!existsSync(base)) continue;\n    try {\n      for (const d of readdirSync(base)) {\n        const full = join(base, d);\n        try {\n          if (statSync(full).isDirectory() && existsSync(join(full, 'places.sqlite'))) {\n            dirs.push(full);\n          }\n        } catch { /* ignore */ }\n      }\n    } catch { /* ignore */ }\n  }\n  return dirs;\n}\n\n// ── Public API ────────────────────────────────────────────────────────────────\n\nexport async function scanAllBookmarks(): Promise<BookmarkHost[]> {\n  const all: BookmarkHost[] = [];\n\n  // Standard browser paths\n  for (const p of chromeLikePaths(CHROME_BASE))   all.push(...readChromeLike(p, 'chrome'));\n  for (const p of chromeLikePaths(CHROMIUM_BASE)) all.push(...readChromeLike(p, 'chromium'));\n  for (const p of chromeLikePaths(EDGE_BASE))     all.push(...readChromeLike(p, 'edge'));\n  for (const p of chromeLikePaths(BRAVE_BASE))    all.push(...readChromeLike(p, 'brave'));\n  for (const p of chromeLikePaths(VIVALDI_BASE))  all.push(...readChromeLike(p, 'vivaldi'));\n  for (const p of chromeLikePaths(OPERA_BASE))    all.push(...readChromeLike(p, 'opera'));\n\n  // Snap / Flatpak paths (Linux only — not macOS, not Windows)\n  if (IS_LINUX) {\n    for (const p of chromeLikePaths(CHROMIUM_SNAP_BASE))    all.push(...readChromeLike(p, 'chromium-snap'));\n    for (const p of chromeLikePaths(CHROMIUM_FLATPAK_BASE)) all.push(...readChromeLike(p, 'chromium-flatpak'));\n    for (const p of chromeLikePaths(CHROME_FLATPAK_BASE))   all.push(...readChromeLike(p, 'chrome-flatpak'));\n    for (const p of chromeLikePaths(BRAVE_FLATPAK_BASE))    all.push(...readChromeLike(p, 'brave-flatpak'));\n    for (const p of chromeLikePaths(EDGE_FLATPAK_BASE))     all.push(...readChromeLike(p, 'edge-flatpak'));\n  }\n\n  // Firefox: standard + snap + flatpak\n  for (const dir of firefoxProfileDirs()) {\n    all.push(...await readFirefoxBookmarks(dir));\n  }\n\n  // Deduplicate by hostname\n  const seen = new Set<string>();\n  return all.filter(h => {\n    if (seen.has(h.hostname)) return false;\n    seen.add(h.hostname);\n    return true;\n  });\n}\n\nexport async function scanAllHistory(): Promise<HistoryHost[]> {\n  const all: HistoryHost[] = [];\n\n  // Standard browser paths\n  for (const p of chromeLikeHistoryPaths(CHROME_BASE))   all.push(...await readChromiumHistory(p, 'chrome'));\n  for (const p of chromeLikeHistoryPaths(CHROMIUM_BASE)) all.push(...await readChromiumHistory(p, 'chromium'));\n  for (const p of chromeLikeHistoryPaths(EDGE_BASE))     all.push(...await readChromiumHistory(p, 'edge'));\n  for (const p of chromeLikeHistoryPaths(BRAVE_BASE))    all.push(...await readChromiumHistory(p, 'brave'));\n  for (const p of chromeLikeHistoryPaths(VIVALDI_BASE))  all.push(...await readChromiumHistory(p, 'vivaldi'));\n  for (const p of chromeLikeHistoryPaths(OPERA_BASE))    all.push(...await readChromiumHistory(p, 'opera'));\n\n  // Snap / Flatpak paths (Linux only — not macOS, not Windows)\n  if (IS_LINUX) {\n    for (const p of chromeLikeHistoryPaths(CHROMIUM_SNAP_BASE))    all.push(...await readChromiumHistory(p, 'chromium-snap'));\n    for (const p of chromeLikeHistoryPaths(CHROMIUM_FLATPAK_BASE)) all.push(...await readChromiumHistory(p, 'chromium-flatpak'));\n    for (const p of chromeLikeHistoryPaths(CHROME_FLATPAK_BASE))   all.push(...await readChromiumHistory(p, 'chrome-flatpak'));\n    for (const p of chromeLikeHistoryPaths(BRAVE_FLATPAK_BASE))    all.push(...await readChromiumHistory(p, 'brave-flatpak'));\n    for (const p of chromeLikeHistoryPaths(EDGE_FLATPAK_BASE))     all.push(...await readChromiumHistory(p, 'edge-flatpak'));\n  }\n\n  // Firefox: standard + snap + flatpak\n  for (const dir of firefoxProfileDirs()) {\n    all.push(...await readFirefoxHistory(dir));\n  }\n\n  // Deduplicate by hostname, summing visit counts\n  const byHost = new Map<string, HistoryHost>();\n  for (const h of all) {\n    const existing = byHost.get(h.hostname);\n    if (existing) {\n      existing.visitCount += h.visitCount;\n    } else {\n      byHost.set(h.hostname, { ...h });\n    }\n  }\n\n  // Sort by visit count descending\n  return [...byHost.values()].sort((a, b) => b.visitCount - a.visitCount);\n}\n","/**\n * Cross-platform utilities for Linux, macOS, and Windows.\n * Centralizes all OS-specific logic so scanning tools work everywhere.\n */\n\nimport { homedir, hostname as osHostname, userInfo } from 'node:os';\nimport { join } from 'node:path';\nimport { execSync } from 'node:child_process';\nimport { existsSync, mkdirSync, readFileSync, writeFileSync } from 'node:fs';\nimport { randomUUID } from 'node:crypto';\nimport { checkReadOnly } from './allowlist.js';\nimport { logWarn } from './logger.js';\n\n// ── Platform detection ───────────────────────────────────────────────────────\n\nexport type Platform = 'linux' | 'darwin' | 'win32';\n\nexport const PLATFORM: Platform = process.platform as Platform;\nexport const IS_WIN = PLATFORM === 'win32';\nexport const IS_MAC = PLATFORM === 'darwin';\nexport const IS_LINUX = PLATFORM === 'linux';\nexport const HOME = homedir();\n\n// ── Source attribution primitives (read-only; never leave the machine in 2.9) ──\n\n/** OS hostname, with a stable fallback so attribution is never empty. */\nexport function hostname(): string {\n  try {\n    const h = osHostname();\n    return h && h.trim() ? h.trim() : 'unknown-host';\n  } catch {\n    return 'unknown-host';\n  }\n}\n\n/** Current OS username, falling back to USER/USERNAME env, then a sentinel. */\nexport function osUser(): string {\n  try {\n    const u = userInfo().username;\n    if (u && u.trim()) return u.trim();\n  } catch {\n    // fall through to env\n  }\n  return process.env.USER ?? process.env.USERNAME ?? 'unknown-user';\n}\n\n/** Process-lifetime memo for {@link machineId} (mirrors the `_shell` cache). */\nlet _machineId: string | undefined;\n\n/**\n * Stable, privacy-respecting per-install identifier: a random UUID v4 cached at\n * `~/.cartography/machine-id` (mode 0600). No hardware fingerprinting, no command\n * execution — allowlist-safe. If the file cannot be read or written (read-only\n * home, missing HOME in CI), it degrades to a process-stable ephemeral UUID with a\n * warning (optional-deps-degrade house style) rather than throwing. The id never\n * leaves the machine in 2.9; it is opaque and non-identifying.\n */\nexport function machineId(): string {\n  if (_machineId) return _machineId;\n  const dir = join(HOME, '.cartography');\n  const file = join(dir, 'machine-id');\n  try {\n    if (existsSync(file)) {\n      const v = readFileSync(file, 'utf8').trim();\n      if (v) return (_machineId = v);\n    }\n    mkdirSync(dir, { recursive: true });\n    const id = randomUUID();\n    writeFileSync(file, id, { mode: 0o600 });\n    return (_machineId = id);\n  } catch (err) {\n    logWarn(`machineId not persisted (using ephemeral id): ${err instanceof Error ? err.message : String(err)}`);\n    return (_machineId = randomUUID());\n  }\n}\n\n// ── Shell selection ──────────────────────────────────────────────────────────\n\n/**\n * Returns the correct shell for execSync on each platform.\n * - Windows: PowerShell (pwsh if available, otherwise powershell.exe)\n * - macOS/Linux: /bin/sh\n */\nexport function platformShell(): string {\n  if (!IS_WIN) return '/bin/sh';\n  // Prefer pwsh (PowerShell 7+) over powershell.exe (5.1)\n  try {\n    execSync('pwsh -Version', { stdio: 'pipe', timeout: 3000 });\n    return 'pwsh';\n  } catch {\n    return 'powershell.exe';\n  }\n}\n\n/** Cached shell value (computed once) */\nlet _shell: string | undefined;\nexport function getShell(): string {\n  if (!_shell) _shell = platformShell();\n  return _shell;\n}\n\n// ── Cross-platform command runner ────────────────────────────────────────────\n\nexport interface RunOptions {\n  timeout?: number;\n  env?: NodeJS.ProcessEnv;\n}\n\n/**\n * Run a shell command, returning stdout as string. Returns '' on error.\n * Automatically uses the correct shell for the platform.\n */\n/** Safe environment variables — excludes secrets from child processes */\nconst SAFE_ENV_KEYS = [\n  'PATH', 'HOME', 'USER', 'LANG', 'LC_ALL', 'TERM', 'SHELL',\n  'USERPROFILE', 'LOCALAPPDATA', 'APPDATA', 'PROGRAMFILES',\n  'XDG_CONFIG_HOME', 'XDG_DATA_HOME', 'XDG_RUNTIME_DIR',\n  'AWS_DEFAULT_REGION', 'AWS_PROFILE', 'AWS_CONFIG_FILE',\n  'KUBECONFIG', 'GOOGLE_APPLICATION_CREDENTIALS',\n  'AZURE_CONFIG_DIR',\n];\n\nexport function safeEnv(): NodeJS.ProcessEnv {\n  const env: NodeJS.ProcessEnv = {};\n  for (const key of SAFE_ENV_KEYS) {\n    if (process.env[key]) env[key] = process.env[key];\n  }\n  return env;\n}\n\nexport function run(cmd: string, opts: RunOptions = {}): string {\n  // Defense in depth: never spawn a command that is not on the read-only allowlist,\n  // regardless of where it originated (scanner template, agent, or MCP tool).\n  const policy = checkReadOnly(cmd, { shell: IS_WIN ? 'powershell' : 'posix' });\n  if (!policy.allowed) {\n    logWarn(`Blocked non-read-only command: ${policy.reason}`);\n    return '';\n  }\n  try {\n    return execSync(cmd, {\n      stdio: 'pipe',\n      timeout: opts.timeout ?? 10_000,\n      shell: getShell(),\n      env: opts.env ?? safeEnv(),\n    }).toString().trim();\n  } catch {\n    return '';\n  }\n}\n\n// ── Command existence check (cross-platform `which`) ─────────────────────────\n\n/**\n * Check if a command exists. Returns its path or '' if not found.\n * - Unix: `which <cmd>`\n * - Windows: `Get-Command <cmd>` via PowerShell\n */\nexport function commandExists(cmd: string): string {\n  if (IS_WIN) {\n    const r = run(`Get-Command ${cmd} -ErrorAction SilentlyContinue | Select-Object -ExpandProperty Source`, { timeout: 5000 });\n    return r;\n  }\n  return run(`which ${cmd} 2>/dev/null`);\n}\n\n// ── Null device ──────────────────────────────────────────────────────────────\n\nexport const NULL_DEV = IS_WIN ? 'NUL' : '/dev/null';\n\n// ── App data directories ─────────────────────────────────────────────────────\n\n/** Returns the platform-specific user app data directory */\nexport function appDataDir(): string {\n  if (IS_WIN) return process.env.LOCALAPPDATA ?? join(HOME, 'AppData', 'Local');\n  if (IS_MAC) return join(HOME, 'Library', 'Application Support');\n  return process.env.XDG_CONFIG_HOME ?? join(HOME, '.config');\n}\n\n/** Returns the platform-specific user data directory (broader than config) */\nexport function userDataDir(): string {\n  if (IS_WIN) return process.env.APPDATA ?? join(HOME, 'AppData', 'Roaming');\n  if (IS_MAC) return join(HOME, 'Library', 'Application Support');\n  return process.env.XDG_DATA_HOME ?? join(HOME, '.local', 'share');\n}\n\n// ── Browser profile base paths (Chromium-based) ──────────────────────────────\n\nexport interface BrowserPaths {\n  chrome: string;\n  chromium: string;\n  edge: string;\n  brave: string;\n  vivaldi: string;\n  opera: string;\n}\n\nexport function browserBasePaths(): BrowserPaths {\n  if (IS_WIN) {\n    const local = process.env.LOCALAPPDATA ?? join(HOME, 'AppData', 'Local');\n    return {\n      chrome:   join(local, 'Google', 'Chrome', 'User Data'),\n      chromium: join(local, 'Chromium', 'User Data'),\n      edge:     join(local, 'Microsoft', 'Edge', 'User Data'),\n      brave:    join(local, 'BraveSoftware', 'Brave-Browser', 'User Data'),\n      vivaldi:  join(local, 'Vivaldi', 'User Data'),\n      opera:    join(userDataDir(), 'Opera Software', 'Opera Stable'),\n    };\n  }\n  if (IS_MAC) {\n    const lib = join(HOME, 'Library', 'Application Support');\n    return {\n      chrome:   join(lib, 'Google', 'Chrome'),\n      chromium: join(lib, 'Chromium'),\n      edge:     join(lib, 'Microsoft Edge'),\n      brave:    join(lib, 'BraveSoftware', 'Brave-Browser'),\n      vivaldi:  join(lib, 'Vivaldi'),\n      opera:    join(lib, 'com.operasoftware.Opera'),\n    };\n  }\n  // Linux\n  return {\n    chrome:   join(HOME, '.config', 'google-chrome'),\n    chromium: join(HOME, '.config', 'chromium'),\n    edge:     join(HOME, '.config', 'microsoft-edge'),\n    brave:    join(HOME, '.config', 'BraveSoftware', 'Brave-Browser'),\n    vivaldi:  join(HOME, '.config', 'vivaldi'),\n    opera:    join(HOME, '.config', 'opera'),\n  };\n}\n\n/** Firefox profile parent directories per platform */\nexport function firefoxBaseDirs(): string[] {\n  if (IS_WIN) {\n    const roaming = process.env.APPDATA ?? join(HOME, 'AppData', 'Roaming');\n    return [join(roaming, 'Mozilla', 'Firefox', 'Profiles')];\n  }\n  if (IS_MAC) {\n    return [join(HOME, 'Library', 'Application Support', 'Firefox', 'Profiles')];\n  }\n  // Linux: standard + snap + flatpak\n  return [\n    join(HOME, '.mozilla', 'firefox'),\n    join(HOME, 'snap', 'firefox', 'common', '.mozilla', 'firefox'),\n    join(HOME, '.var', 'app', 'org.mozilla.firefox', '.mozilla', 'firefox'),\n  ];\n}\n\n// ── Database scan directories ────────────────────────────────────────────────\n\n/** Returns directories to search for SQLite/DB files per platform */\nexport function dbScanDirs(): string[] {\n  const dirs: string[] = [];\n  if (IS_WIN) {\n    const local = process.env.LOCALAPPDATA ?? join(HOME, 'AppData', 'Local');\n    const roaming = process.env.APPDATA ?? join(HOME, 'AppData', 'Roaming');\n    dirs.push(local, roaming);\n    const pd = join(HOME, 'AppData', 'Local', 'Programs');\n    if (existsSync(pd)) dirs.push(pd);\n  } else if (IS_MAC) {\n    dirs.push(join(HOME, 'Library', 'Application Support'));\n    if (existsSync('/var/lib')) dirs.push('/var/lib');\n  } else {\n    const configDir = join(HOME, '.config');\n    const dataDir = join(HOME, '.local', 'share');\n    if (existsSync(configDir)) dirs.push(configDir);\n    if (existsSync(dataDir)) dirs.push(dataDir);\n    if (existsSync('/var/lib')) dirs.push('/var/lib');\n  }\n  return dirs.filter(d => existsSync(d));\n}\n\n// ── File search (cross-platform find) ────────────────────────────────────────\n\n/**\n * Search for files matching glob patterns in given directories.\n * - Unix: `find` command\n * - Windows: PowerShell `Get-ChildItem`\n */\nexport function findFiles(dirs: string[], patterns: string[], maxDepth: number, limit: number): string {\n  if (dirs.length === 0) return '';\n  if (IS_WIN) {\n    const includes = patterns.map(p => `'${p}'`).join(',');\n    const pathList = dirs.map(d => `'${d}'`).join(',');\n    return run(\n      `Get-ChildItem -Path ${pathList} -Recurse -Depth ${maxDepth} -Include ${includes} -ErrorAction SilentlyContinue | Select-Object -First ${limit} -ExpandProperty FullName`,\n      { timeout: 15_000 },\n    );\n  }\n  const nameArgs = patterns.map(p => `-name \"${p}\"`).join(' -o ');\n  const findCmds = dirs.map(d => `find \"${d}\" -maxdepth ${maxDepth} \\\\( ${nameArgs} \\\\) 2>/dev/null`).join('; ');\n  return run(`{ ${findCmds}; } | head -${limit}`, { timeout: 15_000 });\n}\n\n// ── Network scanning ─────────────────────────────────────────────────────────\n\n/** Get all listening TCP ports and the processes behind them */\nexport function scanListeningPorts(): string {\n  if (IS_WIN) {\n    // PowerShell: Get-NetTCPConnection for listening ports + owning process\n    return run(\n      `Get-NetTCPConnection -State Listen -ErrorAction SilentlyContinue | ` +\n      `ForEach-Object { $p = Get-Process -Id $_.OwningProcess -ErrorAction SilentlyContinue; ` +\n      `\"$($_.LocalAddress):$($_.LocalPort) PID=$($_.OwningProcess) $($p.ProcessName)\" } | ` +\n      `Sort-Object -Unique`,\n      { timeout: 15_000 },\n    );\n  }\n  if (IS_MAC) {\n    // macOS: lsof is the most reliable way (ss not available)\n    return run('sudo lsof -iTCP -sTCP:LISTEN -n -P 2>/dev/null || lsof -iTCP -sTCP:LISTEN -n -P 2>/dev/null', { timeout: 15_000 });\n  }\n  // Linux: ss is the standard tool\n  return run('ss -tlnp 2>/dev/null', { timeout: 10_000 });\n}\n\n/**\n * Get all established TCP connections (local→remote) read-only, cross-platform.\n * Mirrors {@link scanListeningPorts}; used by the connections scanner (3.2) to infer\n * `connects_to` edges. Every command is in the read-only allowlist (`ss`/`lsof`/\n * `Get-NetTCPConnection`) and `run()` re-validates before executing.\n */\nexport function scanEstablishedConnections(): string {\n  if (IS_WIN) {\n    return run(\n      `Get-NetTCPConnection -State Established -ErrorAction SilentlyContinue | ` +\n      `ForEach-Object { \"$($_.LocalAddress):$($_.LocalPort) -> $($_.RemoteAddress):$($_.RemotePort)\" } | ` +\n      `Sort-Object -Unique`,\n      { timeout: 15_000 },\n    );\n  }\n  if (IS_MAC) {\n    return run('lsof -nP -iTCP -sTCP:ESTABLISHED 2>/dev/null', { timeout: 15_000 });\n  }\n  return run('ss -tnp state established 2>/dev/null', { timeout: 10_000 });\n}\n\n/** Get running processes (cross-platform) */\nexport function scanProcesses(): string {\n  if (IS_WIN) {\n    return run(\n      `Get-Process | Select-Object -Property Id, ProcessName, Path | Format-Table -AutoSize | Out-String -Width 200`,\n      { timeout: 15_000 },\n    );\n  }\n  return run('ps aux 2>/dev/null', { timeout: 10_000 });\n}\n\n// ── Windows-specific: installed programs ─────────────────────────────────────\n\n/** Scan Windows registry for installed programs */\nexport function scanWindowsPrograms(): string {\n  if (!IS_WIN) return '';\n  return run(\n    `$paths = @(` +\n    `'HKLM:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',` +\n    `'HKLM:\\\\Software\\\\Wow6432Node\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*',` +\n    `'HKCU:\\\\Software\\\\Microsoft\\\\Windows\\\\CurrentVersion\\\\Uninstall\\\\*'` +\n    `); Get-ItemProperty $paths -ErrorAction SilentlyContinue | ` +\n    `Where-Object { $_.DisplayName } | ` +\n    `Select-Object -Property DisplayName, Publisher, DisplayVersion | ` +\n    `Sort-Object DisplayName | ` +\n    `Format-Table -AutoSize | Out-String -Width 300`,\n    { timeout: 20_000 },\n  );\n}\n\n/** Scan Windows services for database engines */\nexport function scanWindowsDbServices(): string {\n  if (!IS_WIN) return '';\n  return run(\n    `Get-Service | Where-Object { ` +\n    `$_.Name -match 'postgres|mysql|mariadb|mongo|redis|MSSQL|elastic|clickhouse|cassandra' ` +\n    `} | Select-Object Name, DisplayName, Status, StartType | Format-Table -AutoSize`,\n    { timeout: 10_000 },\n  );\n}\n\n// ── file:// URL helper ───────────────────────────────────────────────────────\n\n/** Generate a correct file:// URL for the current platform */\nexport function fileUrl(absPath: string): string {\n  if (IS_WIN) {\n    // Windows: file:///C:/Users/... (forward slashes, triple slash)\n    const normalized = absPath.replace(/\\\\/g, '/');\n    return `file:///${normalized}`;\n  }\n  return `file://${absPath}`;\n}\n","/**\n * Read-only command policy — a strict allowlist.\n *\n * Unlike a denylist (which is inherently leaky — novel destructive commands slip\n * through), this module permits only commands that are known to be read-only and\n * rejects everything else. It is the authoritative safety boundary for every\n * command the package spawns, independent of which agent or LLM is driving.\n *\n * The check is shell-aware: it splits a command line into segments on the control\n * operators `|`, `&&`, `||`, `;` (respecting single/double quotes), then validates\n * the leading executable of each segment plus its sub-command/arguments.\n */\n\n/** Plain read-only executables — no sub-command restriction needed. */\nconst READONLY_BINARIES = new Set<string>([\n  // shell & text utilities\n  'echo', 'printf', 'true', 'false', 'test', 'cat', 'head', 'tail', 'grep', 'egrep',\n  'fgrep', 'awk', 'sed', 'cut', 'sort', 'uniq', 'wc', 'tr', 'xargs', 'tee',\n  'ls', 'find', 'which', 'command', 'type', 'basename', 'dirname', 'realpath',\n  'readlink', 'stat', 'file', 'printenv', 'date', 'hostname', 'uname',\n  'whoami', 'id', 'pwd', 'expr', 'seq', 'tac', 'rev', 'column', 'paste',\n  // network & process inspection (read-only)\n  'ss', 'netstat', 'lsof', 'ps', 'ip', 'ifconfig', 'arp', 'dig', 'nslookup', 'host',\n  // database clients (read-only usage is enforced separately for risky verbs)\n  'psql', 'mysql', 'mysqladmin', 'mongosh', 'redis-cli', 'sqlite3', 'pg_lsclusters',\n  'clickhouse-client',\n  // macOS\n  'mdfind',\n]);\n\n/** `tee` is read-only only when writing to the bit bucket; otherwise it writes files. */\nconst CONDITIONAL_BINARIES = new Set<string>(['tee']);\n\n/** Package managers: list/query only — reject install/remove/upgrade-style verbs and flags. */\nconst PKG_MANAGERS = new Set<string>(['dpkg', 'rpm', 'snap', 'flatpak', 'brew', 'winget', 'choco', 'scoop', 'apt-cache']);\nconst MUTATING_PKG = /^(install|uninstall|reinstall|remove|purge|erase|upgrade|update|add|delete|pin|enable|disable|-i|--install|-r|--remove|-P|--purge|-e|--erase|-U|--upgrade|-F|--freshen)$/i;\n\n/** Executables that run another command supplied as an argument — must be validated recursively. */\nconst COMMAND_RUNNERS = new Set<string>(['xargs', 'env', 'nice', 'nohup', 'timeout', 'time', 'stdbuf', 'watch', 'sudo']);\n\n/** Mutating PowerShell cmdlets and Windows commands — rejected in PowerShell mode. */\nconst DANGEROUS_PS = /\\b(Remove-Item|Remove-ItemProperty|Move-Item|Copy-Item|Rename-Item|New-Item|New-Service|Set-Content|Add-Content|Clear-Content|Out-File|Set-ItemProperty|Set-Service|Stop-Process|Stop-Service|Start-Service|Restart-Service|Stop-Computer|Restart-Computer|Format-Volume|Clear-Disk|Remove-\\w+|Uninstall-\\w+|Install-\\w+|Set-\\w+|New-\\w+|Start-\\w+|Stop-\\w+|Restart-\\w+|Invoke-Expression|iex|Invoke-WebRequest|Invoke-RestMethod|Invoke-Command|Start-Process|Register-\\w+|Unregister-\\w+|Disable-\\w+|Enable-\\w+|Reset-\\w+|del|rmdir|rd)\\b/i;\n\n/** Coarse Unix destructive denylist — defense-in-depth backstop. */\nconst DANGEROUS_POSIX = /\\b(rm|rmdir|mv|dd|mkfs|chmod|chown|chgrp|kill|killall|pkill|reboot|shutdown|poweroff|halt|truncate|shred|fdisk|parted)\\b/i;\n\n/**\n * Multi-verb tools: the first non-flag token after the binary (and, for some, the\n * whole token list) must satisfy a read-only predicate.\n */\nconst SUBCOMMAND_RULES: Record<string, (tokens: string[]) => boolean> = {\n  kubectl: (t) => allowFirstVerb(t, ['get', 'describe', 'top', 'logs', 'explain', 'config', 'version', 'cluster-info', 'api-resources', 'api-versions', 'auth']),\n  docker: (t) => allowFirstVerb(t, ['ps', 'images', 'inspect', 'version', 'info', 'logs', 'stats', 'top', 'port', 'history', 'diff', 'system', 'context', 'volume', 'network', 'image', 'container']) && !hasMutatingDockerVerb(t),\n  podman: (t) => SUBCOMMAND_RULES['docker']!(t),\n  helm: (t) => allowFirstVerb(t, ['list', 'ls', 'status', 'get', 'show', 'history', 'version', 'repo', 'search', 'env']),\n  systemctl: (t) => allowFirstVerb(t, ['status', 'show', 'list-units', 'list-unit-files', 'list-sockets', 'list-timers', 'list-dependencies', 'is-active', 'is-enabled', 'is-failed', 'cat', 'get-default', 'show-environment']),\n  service: (t) => t.some((x) => /^status$/i.test(x)),\n  // cloud CLIs: read-only actions only — must contain a read verb, never a mutating one\n  aws: (t) => containsAwsReadAction(t) && !hasMutatingCloudVerb(t),\n  gcloud: (t) => (hasToken(t, ['list', 'describe']) || isInfoOnly(t)) && !hasMutatingCloudVerb(gcloudActionTokens(t)),\n  az: (t) => (hasToken(t, ['list', 'show']) || isInfoOnly(t)) && !hasMutatingCloudVerb(t),\n  // version control (read-only verbs only)\n  git: (t) => allowFirstVerb(t, ['status', 'log', 'show', 'diff', 'branch', 'remote', 'config', 'rev-parse', 'ls-files', 'ls-remote', 'describe', 'tag', 'shortlog', 'cat-file', 'symbolic-ref']),\n  gh: (t) => allowFirstVerb(t, ['repo', 'pr', 'issue', 'release', 'api', 'auth', 'status']) && hasToken(t, ['list', 'view', 'status', 'get']),\n};\n\n/** curl/wget: GET-only, no file writes, no request methods or bodies. */\nconst FETCH_RULES: Record<string, (tokens: string[]) => boolean> = {\n  curl: (t) => !t.some((x) => /^-X$/i.test(x) || /^--request$/i.test(x) || /^-[dF]$/.test(x) || /^--data/i.test(x) || /^--form$/i.test(x) || /^-[oO]$/.test(x) || /^--output$/i.test(x) || /^--upload-file$/i.test(x)),\n  wget: (t) => !t.some((x) => /^-O$/.test(x) || /^--output-document/i.test(x) || /^--post-data/i.test(x) || /^--method/i.test(x) || /^-i$/.test(x)),\n};\n\n/** Read-only PowerShell verbs (cmdlets are `Verb-Noun`). */\nconst READONLY_PS_VERBS = new Set<string>([\n  'get', 'select', 'where', 'measure', 'sort', 'format', 'out', 'convertto',\n  'convertfrom', 'compare', 'test', 'resolve', 'split', 'join', 'group', 'foreach',\n  'write', 'read', 'show', 'find', 'search', 'tee',\n]);\n\n/** Bare PowerShell helpers / aliases that are read-only. */\nconst READONLY_PS_BARE = new Set<string>(['where', 'select', 'sort', 'foreach', 'ft', 'fl', 'gci', 'gc', 'gm', 'gps', 'gsv', 'echo', 'write-host', 'write-output']);\n\nexport interface PolicyResult {\n  allowed: boolean;\n  reason?: string;\n}\n\nexport type ShellKind = 'posix' | 'powershell';\n\n// ── Helpers ──────────────────────────────────────────────────────────────────\n\nfunction allowFirstVerb(tokens: string[], verbs: string[]): boolean {\n  const verb = tokens.find((t) => !t.startsWith('-'));\n  return verb !== undefined && verbs.includes(verb.toLowerCase());\n}\n\nfunction hasToken(tokens: string[], any: string[]): boolean {\n  const lower = tokens.map((t) => t.toLowerCase());\n  return any.some((a) => lower.includes(a));\n}\n\nfunction isInfoOnly(tokens: string[]): boolean {\n  // e.g. `gcloud config list ...`, `az account show`\n  return hasToken(tokens, ['config', 'account', 'version', 'info']);\n}\n\nconst MUTATING_CLOUD = /^(create|delete|update|put|set|add|remove|deploy|run|start|stop|restart|reboot|terminate|modify|attach|detach|associate|disassociate|enable|disable|invoke|exec|apply|destroy|scale|patch|register|deregister|import|copy|move|rename|reset|rotate|revoke|grant)([-_].*)?$/i;\n\nfunction hasMutatingCloudVerb(tokens: string[]): boolean {\n  return tokens.some((t) => !t.startsWith('-') && MUTATING_CLOUD.test(t));\n}\n\n/**\n * gcloud service *groups* whose name collides with a mutating-verb token but is\n * a read-only noun in `gcloud <group> ... list/describe` (e.g. `gcloud run\n * services list`). We drop the leading service-group noun before the mutating-verb\n * check so a legitimate read is not blocked, while any *trailing* mutating action\n * (`gcloud run deploy …`) is still caught — those commands carry no `list`/`describe`\n * read verb and so fail the gcloud read-verb gate regardless.\n */\nconst GCLOUD_GROUP_NOUNS = new Set<string>(['run', 'import', 'reset', 'scan']);\n\n/** Drop a single leading gcloud service-group noun (the token right after `gcloud`). */\nfunction gcloudActionTokens(tokens: string[]): string[] {\n  const firstPositional = tokens.findIndex((t) => !t.startsWith('-'));\n  if (firstPositional !== -1 && GCLOUD_GROUP_NOUNS.has(tokens[firstPositional]!.toLowerCase())) {\n    return [...tokens.slice(0, firstPositional), ...tokens.slice(firstPositional + 1)];\n  }\n  return tokens;\n}\n\nfunction containsAwsReadAction(tokens: string[]): boolean {\n  // aws <service> <action> — action must be read-only\n  return tokens.some((t) => /^(describe|list|get|lookup|search|scan|view|ls)[-_a-z0-9]*$/i.test(t) || t.toLowerCase() === 'ls');\n}\n\nfunction hasMutatingDockerVerb(tokens: string[]): boolean {\n  return tokens.some((t) => /^(run|rm|rmi|exec|build|push|pull|start|stop|kill|create|commit|cp|save|load|tag|login|logout|prune|kill|restart|pause|unpause|rename|update|export|import)$/i.test(t));\n}\n\n/** Split a command line on shell control operators, honoring single/double quotes. */\nexport function splitSegments(cmd: string): string[] {\n  const segments: string[] = [];\n  let buf = '';\n  let quote: '\"' | \"'\" | null = null;\n  for (let i = 0; i < cmd.length; i++) {\n    const c = cmd[i]!;\n    const next = cmd[i + 1];\n    if (quote) {\n      buf += c;\n      if (c === quote) quote = null;\n      continue;\n    }\n    if (c === '\"' || c === \"'\") { quote = c; buf += c; continue; }\n    // command substitution is rejected wholesale elsewhere; treat `$(` as a break too\n    if ((c === '|' && next === '|') || (c === '&' && next === '&')) { segments.push(buf); buf = ''; i++; continue; }\n    if (c === '|' || c === ';' || c === '\\n') { segments.push(buf); buf = ''; continue; }\n    buf += c;\n  }\n  segments.push(buf);\n  return segments.map((s) => s.trim()).filter(Boolean);\n}\n\n/** Tokenize one segment into words, honoring quotes and stripping them. */\nfunction tokenize(segment: string): string[] {\n  const tokens: string[] = [];\n  let buf = '';\n  let quote: '\"' | \"'\" | null = null;\n  let started = false;\n  const push = () => { if (started) { tokens.push(buf); buf = ''; started = false; } };\n  for (let i = 0; i < segment.length; i++) {\n    const c = segment[i]!;\n    if (quote) { if (c === quote) quote = null; else buf += c; started = true; continue; }\n    if (c === '\"' || c === \"'\") { quote = c; started = true; continue; }\n    if (c === ' ' || c === '\\t') { push(); continue; }\n    buf += c; started = true;\n  }\n  push();\n  return tokens;\n}\n\nfunction baseName(executable: string): string {\n  const noPath = executable.split(/[\\\\/]/).pop() ?? executable;\n  return noPath.toLowerCase();\n}\n\n/** `find` is read-only unless it is asked to execute or delete. */\nfunction findIsReadOnly(rest: string[]): boolean {\n  return !rest.some((t) => /^-(exec|execdir|ok|okdir|delete|fprintf|fprint|fls)$/i.test(t));\n}\n\n/** Guard `awk`/`sed` programs against shelling out. */\nfunction awkSedIsReadOnly(exe: string, rest: string[]): boolean {\n  const program = rest.join(' ');\n  if (exe === 'awk') return !/\\bsystem\\s*\\(/.test(program) && !/\\|\\s*[\"']/.test(program) && !/print\\s*>/.test(program);\n  // sed: reject the `e` (execute) command and the s///e flag and `w` (write file)\n  return !/(^|;|\\{|\\s)e\\b/.test(program) && !/s[^\\s]*\\/[a-z]*e[a-z]*\\b/i.test(program) && !/\\bw\\s+\\S/.test(program);\n}\n\nfunction isWriteRedirect(segment: string): boolean {\n  // Allow only redirects to the bit bucket / stderr merge: 2>/dev/null, >/dev/null, 2>&1, *> $null, Out-Null\n  // Reject any other `>` or `>>` (file writes).\n  const stripped = segment\n    .replace(/\\d?>>?\\s*\\/dev\\/null/g, '')\n    .replace(/\\d?>\\s*&\\s*\\d/g, '')\n    .replace(/\\d?>\\s*\\$null/gi, '');\n  return /(^|[^0-9&])>>?/.test(stripped);\n}\n\n// ── Public API ─────────────────────────────────────────────────────────────────\n\n/**\n * Decide whether a command line is read-only and therefore safe to execute.\n * Returns `{ allowed: false, reason }` for anything not explicitly permitted.\n */\nexport function checkReadOnly(command: string, opts: { shell?: ShellKind } = {}): PolicyResult {\n  const cmd = command.trim();\n  if (!cmd) return { allowed: false, reason: 'empty command' };\n\n  // PowerShell uses `$(...)`, `;`-in-blocks and `{}` legitimately, so a POSIX parser\n  // would mis-fire. In PowerShell mode we reject file writes and mutating cmdlets instead.\n  if (opts.shell === 'powershell') {\n    if (isWriteRedirect(cmd)) return { allowed: false, reason: 'file-writing redirect is not allowed' };\n    if (DANGEROUS_PS.test(cmd)) return { allowed: false, reason: 'mutating PowerShell cmdlet is not allowed' };\n    if (DANGEROUS_POSIX.test(cmd)) return { allowed: false, reason: 'destructive command is not allowed' };\n    return { allowed: true };\n  }\n\n  // Reject command substitution and backticks — they hide arbitrary execution.\n  if (/\\$\\(|`/.test(cmd)) return { allowed: false, reason: 'command substitution is not allowed' };\n\n  // Reject file-writing redirects (anything other than /dev/null or stderr merge).\n  if (isWriteRedirect(cmd)) return { allowed: false, reason: 'file-writing redirect is not allowed' };\n\n  for (const segment of splitSegments(cmd)) {\n    const r = checkSegment(segment);\n    if (!r.allowed) return r;\n  }\n\n  return { allowed: true };\n}\n\n/** Validate a single pipeline segment's leading executable and its arguments. */\nfunction checkSegment(segment: string): PolicyResult {\n  // Drop leading inline env assignments (`FOO=bar cmd`) and shell grouping tokens (`{ } ( )`).\n  let tokens = tokenize(segment)\n    .filter((t) => !/^[A-Za-z_][A-Za-z0-9_]*=/.test(t))\n    .filter((t) => t !== '{' && t !== '}' && t !== '(' && t !== ')');\n  if (tokens.length === 0) return { allowed: true };\n\n  let exe = baseName(tokens[0]!);\n  let rest = tokens.slice(1);\n\n  // Command runners (xargs, timeout, nice, env, ...): unwrap to the inner command and validate it.\n  while (COMMAND_RUNNERS.has(exe)) {\n    // skip the runner's own flags and their values, plus xargs replace-string (-I {})\n    const inner: string[] = [];\n    let i = 0;\n    for (; i < rest.length; i++) {\n      const t = rest[i]!;\n      if (t.startsWith('-')) { if (/^-(I|n|L|P|d|s|E|u|g)$/.test(t)) i++; continue; }\n      inner.push(...rest.slice(i));\n      break;\n    }\n    if (inner.length === 0) return { allowed: true }; // runner with no inner command (e.g. `env`, `xargs echo`-less)\n    exe = baseName(inner[0]!);\n    rest = inner.slice(1);\n  }\n\n  if (exe === 'find') {\n    if (!findIsReadOnly(rest)) return { allowed: false, reason: 'find: -exec/-delete is not allowed' };\n    return { allowed: true };\n  }\n  if (exe === 'awk' || exe === 'sed') {\n    if (!awkSedIsReadOnly(exe, rest)) return { allowed: false, reason: `${exe}: program may not shell out or write files` };\n    return { allowed: true };\n  }\n  if (PKG_MANAGERS.has(exe)) {\n    if (rest.some((t) => MUTATING_PKG.test(t))) return { allowed: false, reason: `${exe}: only list/query sub-commands are allowed` };\n    return { allowed: true };\n  }\n  if (FETCH_RULES[exe]) {\n    if (!FETCH_RULES[exe]!(rest)) return { allowed: false, reason: `${exe}: only read-only GET requests are allowed` };\n    return { allowed: true };\n  }\n  if (SUBCOMMAND_RULES[exe]) {\n    if (!SUBCOMMAND_RULES[exe]!(rest)) return { allowed: false, reason: `${exe}: sub-command is not read-only` };\n    return { allowed: true };\n  }\n  if (CONDITIONAL_BINARIES.has(exe)) {\n    if (rest.some((t) => !t.startsWith('-') && t !== '/dev/null')) return { allowed: false, reason: 'tee may only write to /dev/null' };\n    return { allowed: true };\n  }\n  if (READONLY_BINARIES.has(exe)) return { allowed: true };\n  if (READONLY_PS_BARE.has(exe)) return { allowed: true };\n\n  // PowerShell cmdlet fallback: Verb-Noun where the verb must be read-only.\n  if (exe.includes('-') && /^[a-z]+-[a-z]/.test(exe)) {\n    const verb = exe.split('-')[0]!;\n    if (READONLY_PS_VERBS.has(verb)) return { allowed: true };\n    return { allowed: false, reason: `PowerShell cmdlet not read-only: ${exe}` };\n  }\n\n  return { allowed: false, reason: `command not on read-only allowlist: ${exe}` };\n}\n\n/** Convenience boolean form. */\nexport function isReadOnlyCommand(command: string): boolean {\n  return checkReadOnly(command).allowed;\n}\n\n/** Throwing form for guard sites that prefer exceptions. */\nexport function assertReadOnly(command: string): void {\n  const r = checkReadOnly(command);\n  if (!r.allowed) throw new Error(`Blocked by read-only allowlist: ${r.reason}`);\n}\n","/**\n * Structured logging for enterprise observability.\n * Outputs JSON to stderr for compatibility with ELK, Datadog, Splunk, CloudWatch.\n */\n\nexport type LogLevel = 'DEBUG' | 'INFO' | 'WARN' | 'ERROR';\n\nexport interface LogEntry {\n  timestamp: string;\n  level: LogLevel;\n  message: string;\n  context?: Record<string, unknown>;\n}\n\nlet verboseMode = false;\n\nexport function setVerbose(v: boolean): void {\n  verboseMode = v;\n}\n\nexport function log(level: LogLevel, message: string, context?: Record<string, unknown>): void {\n  if (level === 'DEBUG' && !verboseMode) return;\n\n  const entry: LogEntry = {\n    timestamp: new Date().toISOString(),\n    level,\n    message,\n    ...(context && Object.keys(context).length > 0 ? { context } : {}),\n  };\n  process.stderr.write(JSON.stringify(entry) + '\\n');\n}\n\nexport function logDebug(message: string, context?: Record<string, unknown>): void {\n  log('DEBUG', message, context);\n}\n\nexport function logInfo(message: string, context?: Record<string, unknown>): void {\n  log('INFO', message, context);\n}\n\nexport function logWarn(message: string, context?: Record<string, unknown>): void {\n  log('WARN', message, context);\n}\n\nexport function logError(message: string, context?: Record<string, unknown>): void {\n  log('ERROR', message, context);\n}\n"],"mappings":";;;AAAA,SAAS,cAAc;AACvB,SAAS,cAAAA,aAAY,gBAAAC,eAAc,aAAa,cAAc,UAAU,kBAAkB;AAC1F,SAAS,QAAAC,aAAY;;;ACGrB,SAAS,SAAS,YAAY,YAAY,gBAAgB;AAC1D,SAAS,YAAY;AACrB,SAAS,gBAAgB;AACzB,SAAS,YAAY,WAAW,cAAc,qBAAqB;AACnE,SAAS,kBAAkB;;;ACK3B,IAAM,oBAAoB,oBAAI,IAAY;AAAA;AAAA,EAExC;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAC1E;AAAA,EAAS;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAM;AAAA,EAAS;AAAA,EACnE;AAAA,EAAM;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAW;AAAA,EACjE;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAY;AAAA,EAAQ;AAAA,EAAY;AAAA,EAC5D;AAAA,EAAU;AAAA,EAAM;AAAA,EAAO;AAAA,EAAQ;AAAA,EAAO;AAAA,EAAO;AAAA,EAAO;AAAA,EAAU;AAAA;AAAA,EAE9D;AAAA,EAAM;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAM;AAAA,EAAM;AAAA,EAAY;AAAA,EAAO;AAAA,EAAO;AAAA,EAAY;AAAA;AAAA,EAE3E;AAAA,EAAQ;AAAA,EAAS;AAAA,EAAc;AAAA,EAAW;AAAA,EAAa;AAAA,EAAW;AAAA,EAClE;AAAA;AAAA,EAEA;AACF,CAAC;AAGD,IAAM,uBAAuB,oBAAI,IAAY,CAAC,KAAK,CAAC;AAGpD,IAAM,eAAe,oBAAI,IAAY,CAAC,QAAQ,OAAO,QAAQ,WAAW,QAAQ,UAAU,SAAS,SAAS,WAAW,CAAC;AACxH,IAAM,eAAe;AAGrB,IAAM,kBAAkB,oBAAI,IAAY,CAAC,SAAS,OAAO,QAAQ,SAAS,WAAW,QAAQ,UAAU,SAAS,MAAM,CAAC;AAGvH,IAAM,eAAe;AAGrB,IAAM,kBAAkB;AAMxB,IAAM,mBAAkE;AAAA,EACtE,SAAS,CAAC,MAAM,eAAe,GAAG,CAAC,OAAO,YAAY,OAAO,QAAQ,WAAW,UAAU,WAAW,gBAAgB,iBAAiB,gBAAgB,MAAM,CAAC;AAAA,EAC7J,QAAQ,CAAC,MAAM,eAAe,GAAG,CAAC,MAAM,UAAU,WAAW,WAAW,QAAQ,QAAQ,SAAS,OAAO,QAAQ,WAAW,QAAQ,UAAU,WAAW,UAAU,WAAW,SAAS,WAAW,CAAC,KAAK,CAAC,sBAAsB,CAAC;AAAA,EAC/N,QAAQ,CAAC,MAAM,iBAAiB,QAAQ,EAAG,CAAC;AAAA,EAC5C,MAAM,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,MAAM,UAAU,OAAO,QAAQ,WAAW,WAAW,QAAQ,UAAU,KAAK,CAAC;AAAA,EACrH,WAAW,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,QAAQ,cAAc,mBAAmB,gBAAgB,eAAe,qBAAqB,aAAa,cAAc,aAAa,OAAO,eAAe,kBAAkB,CAAC;AAAA,EAC7N,SAAS,CAAC,MAAM,EAAE,KAAK,CAAC,MAAM,YAAY,KAAK,CAAC,CAAC;AAAA;AAAA,EAEjD,KAAK,CAAC,MAAM,sBAAsB,CAAC,KAAK,CAAC,qBAAqB,CAAC;AAAA,EAC/D,QAAQ,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,UAAU,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,qBAAqB,mBAAmB,CAAC,CAAC;AAAA,EAClH,IAAI,CAAC,OAAO,SAAS,GAAG,CAAC,QAAQ,MAAM,CAAC,KAAK,WAAW,CAAC,MAAM,CAAC,qBAAqB,CAAC;AAAA;AAAA,EAEtF,KAAK,CAAC,MAAM,eAAe,GAAG,CAAC,UAAU,OAAO,QAAQ,QAAQ,UAAU,UAAU,UAAU,aAAa,YAAY,aAAa,YAAY,OAAO,YAAY,YAAY,cAAc,CAAC;AAAA,EAC9L,IAAI,CAAC,MAAM,eAAe,GAAG,CAAC,QAAQ,MAAM,SAAS,WAAW,OAAO,QAAQ,QAAQ,CAAC,KAAK,SAAS,GAAG,CAAC,QAAQ,QAAQ,UAAU,KAAK,CAAC;AAC5I;AAGA,IAAM,cAA6D;AAAA,EACjE,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,QAAQ,KAAK,CAAC,KAAK,eAAe,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,WAAW,KAAK,CAAC,KAAK,YAAY,KAAK,CAAC,KAAK,UAAU,KAAK,CAAC,KAAK,cAAc,KAAK,CAAC,KAAK,mBAAmB,KAAK,CAAC,CAAC;AAAA,EACnN,MAAM,CAAC,MAAM,CAAC,EAAE,KAAK,CAAC,MAAM,OAAO,KAAK,CAAC,KAAK,sBAAsB,KAAK,CAAC,KAAK,gBAAgB,KAAK,CAAC,KAAK,aAAa,KAAK,CAAC,KAAK,OAAO,KAAK,CAAC,CAAC;AAClJ;AAGA,IAAM,oBAAoB,oBAAI,IAAY;AAAA,EACxC;AAAA,EAAO;AAAA,EAAU;AAAA,EAAS;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAO;AAAA,EAC9D;AAAA,EAAe;AAAA,EAAW;AAAA,EAAQ;AAAA,EAAW;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAS;AAAA,EACvE;AAAA,EAAS;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAC7C,CAAC;AAGD,IAAM,mBAAmB,oBAAI,IAAY,CAAC,SAAS,UAAU,QAAQ,WAAW,MAAM,MAAM,OAAO,MAAM,MAAM,OAAO,OAAO,QAAQ,cAAc,cAAc,CAAC;AAWlK,SAAS,eAAe,QAAkB,OAA0B;AAClE,QAAM,OAAO,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClD,SAAO,SAAS,UAAa,MAAM,SAAS,KAAK,YAAY,CAAC;AAChE;AAEA,SAAS,SAAS,QAAkB,KAAwB;AAC1D,QAAM,QAAQ,OAAO,IAAI,CAAC,MAAM,EAAE,YAAY,CAAC;AAC/C,SAAO,IAAI,KAAK,CAAC,MAAM,MAAM,SAAS,CAAC,CAAC;AAC1C;AAEA,SAAS,WAAW,QAA2B;AAE7C,SAAO,SAAS,QAAQ,CAAC,UAAU,WAAW,WAAW,MAAM,CAAC;AAClE;AAEA,IAAM,iBAAiB;AAEvB,SAAS,qBAAqB,QAA2B;AACvD,SAAO,OAAO,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,eAAe,KAAK,CAAC,CAAC;AACxE;AAUA,IAAM,qBAAqB,oBAAI,IAAY,CAAC,OAAO,UAAU,SAAS,MAAM,CAAC;AAG7E,SAAS,mBAAmB,QAA4B;AACtD,QAAM,kBAAkB,OAAO,UAAU,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,CAAC;AAClE,MAAI,oBAAoB,MAAM,mBAAmB,IAAI,OAAO,eAAe,EAAG,YAAY,CAAC,GAAG;AAC5F,WAAO,CAAC,GAAG,OAAO,MAAM,GAAG,eAAe,GAAG,GAAG,OAAO,MAAM,kBAAkB,CAAC,CAAC;AAAA,EACnF;AACA,SAAO;AACT;AAEA,SAAS,sBAAsB,QAA2B;AAExD,SAAO,OAAO,KAAK,CAAC,MAAM,+DAA+D,KAAK,CAAC,KAAK,EAAE,YAAY,MAAM,IAAI;AAC9H;AAEA,SAAS,sBAAsB,QAA2B;AACxD,SAAO,OAAO,KAAK,CAAC,MAAM,gKAAgK,KAAK,CAAC,CAAC;AACnM;AAGO,SAAS,cAAc,KAAuB;AACnD,QAAM,WAAqB,CAAC;AAC5B,MAAI,MAAM;AACV,MAAI,QAA0B;AAC9B,WAAS,IAAI,GAAG,IAAI,IAAI,QAAQ,KAAK;AACnC,UAAM,IAAI,IAAI,CAAC;AACf,UAAM,OAAO,IAAI,IAAI,CAAC;AACtB,QAAI,OAAO;AACT,aAAO;AACP,UAAI,MAAM,MAAO,SAAQ;AACzB;AAAA,IACF;AACA,QAAI,MAAM,OAAO,MAAM,KAAK;AAAE,cAAQ;AAAG,aAAO;AAAG;AAAA,IAAU;AAE7D,QAAK,MAAM,OAAO,SAAS,OAAS,MAAM,OAAO,SAAS,KAAM;AAAE,eAAS,KAAK,GAAG;AAAG,YAAM;AAAI;AAAK;AAAA,IAAU;AAC/G,QAAI,MAAM,OAAO,MAAM,OAAO,MAAM,MAAM;AAAE,eAAS,KAAK,GAAG;AAAG,YAAM;AAAI;AAAA,IAAU;AACpF,WAAO;AAAA,EACT;AACA,WAAS,KAAK,GAAG;AACjB,SAAO,SAAS,IAAI,CAAC,MAAM,EAAE,KAAK,CAAC,EAAE,OAAO,OAAO;AACrD;AAGA,SAAS,SAAS,SAA2B;AAC3C,QAAM,SAAmB,CAAC;AAC1B,MAAI,MAAM;AACV,MAAI,QAA0B;AAC9B,MAAI,UAAU;AACd,QAAM,OAAO,MAAM;AAAE,QAAI,SAAS;AAAE,aAAO,KAAK,GAAG;AAAG,YAAM;AAAI,gBAAU;AAAA,IAAO;AAAA,EAAE;AACnF,WAAS,IAAI,GAAG,IAAI,QAAQ,QAAQ,KAAK;AACvC,UAAM,IAAI,QAAQ,CAAC;AACnB,QAAI,OAAO;AAAE,UAAI,MAAM,MAAO,SAAQ;AAAA,UAAW,QAAO;AAAG,gBAAU;AAAM;AAAA,IAAU;AACrF,QAAI,MAAM,OAAO,MAAM,KAAK;AAAE,cAAQ;AAAG,gBAAU;AAAM;AAAA,IAAU;AACnE,QAAI,MAAM,OAAO,MAAM,KAAM;AAAE,WAAK;AAAG;AAAA,IAAU;AACjD,WAAO;AAAG,cAAU;AAAA,EACtB;AACA,OAAK;AACL,SAAO;AACT;AAEA,SAAS,SAAS,YAA4B;AAC5C,QAAM,SAAS,WAAW,MAAM,OAAO,EAAE,IAAI,KAAK;AAClD,SAAO,OAAO,YAAY;AAC5B;AAGA,SAAS,eAAe,MAAyB;AAC/C,SAAO,CAAC,KAAK,KAAK,CAAC,MAAM,wDAAwD,KAAK,CAAC,CAAC;AAC1F;AAGA,SAAS,iBAAiB,KAAa,MAAyB;AAC9D,QAAM,UAAU,KAAK,KAAK,GAAG;AAC7B,MAAI,QAAQ,MAAO,QAAO,CAAC,gBAAgB,KAAK,OAAO,KAAK,CAAC,YAAY,KAAK,OAAO,KAAK,CAAC,YAAY,KAAK,OAAO;AAEnH,SAAO,CAAC,iBAAiB,KAAK,OAAO,KAAK,CAAC,4BAA4B,KAAK,OAAO,KAAK,CAAC,WAAW,KAAK,OAAO;AAClH;AAEA,SAAS,gBAAgB,SAA0B;AAGjD,QAAM,WAAW,QACd,QAAQ,yBAAyB,EAAE,EACnC,QAAQ,kBAAkB,EAAE,EAC5B,QAAQ,mBAAmB,EAAE;AAChC,SAAO,iBAAiB,KAAK,QAAQ;AACvC;AAQO,SAAS,cAAc,SAAiB,OAA8B,CAAC,GAAiB;AAC7F,QAAM,MAAM,QAAQ,KAAK;AACzB,MAAI,CAAC,IAAK,QAAO,EAAE,SAAS,OAAO,QAAQ,gBAAgB;AAI3D,MAAI,KAAK,UAAU,cAAc;AAC/B,QAAI,gBAAgB,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,uCAAuC;AAClG,QAAI,aAAa,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,4CAA4C;AACzG,QAAI,gBAAgB,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,qCAAqC;AACrG,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AAGA,MAAI,SAAS,KAAK,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,sCAAsC;AAG/F,MAAI,gBAAgB,GAAG,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,uCAAuC;AAElG,aAAW,WAAW,cAAc,GAAG,GAAG;AACxC,UAAM,IAAI,aAAa,OAAO;AAC9B,QAAI,CAAC,EAAE,QAAS,QAAO;AAAA,EACzB;AAEA,SAAO,EAAE,SAAS,KAAK;AACzB;AAGA,SAAS,aAAa,SAA+B;AAEnD,MAAI,SAAS,SAAS,OAAO,EAC1B,OAAO,CAAC,MAAM,CAAC,2BAA2B,KAAK,CAAC,CAAC,EACjD,OAAO,CAAC,MAAM,MAAM,OAAO,MAAM,OAAO,MAAM,OAAO,MAAM,GAAG;AACjE,MAAI,OAAO,WAAW,EAAG,QAAO,EAAE,SAAS,KAAK;AAEhD,MAAI,MAAM,SAAS,OAAO,CAAC,CAAE;AAC7B,MAAI,OAAO,OAAO,MAAM,CAAC;AAGzB,SAAO,gBAAgB,IAAI,GAAG,GAAG;AAE/B,UAAM,QAAkB,CAAC;AACzB,QAAI,IAAI;AACR,WAAO,IAAI,KAAK,QAAQ,KAAK;AAC3B,YAAM,IAAI,KAAK,CAAC;AAChB,UAAI,EAAE,WAAW,GAAG,GAAG;AAAE,YAAI,yBAAyB,KAAK,CAAC,EAAG;AAAK;AAAA,MAAU;AAC9E,YAAM,KAAK,GAAG,KAAK,MAAM,CAAC,CAAC;AAC3B;AAAA,IACF;AACA,QAAI,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,KAAK;AAC/C,UAAM,SAAS,MAAM,CAAC,CAAE;AACxB,WAAO,MAAM,MAAM,CAAC;AAAA,EACtB;AAEA,MAAI,QAAQ,QAAQ;AAClB,QAAI,CAAC,eAAe,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,qCAAqC;AACjG,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,QAAQ,SAAS,QAAQ,OAAO;AAClC,QAAI,CAAC,iBAAiB,KAAK,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,6CAA6C;AACtH,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,aAAa,IAAI,GAAG,GAAG;AACzB,QAAI,KAAK,KAAK,CAAC,MAAM,aAAa,KAAK,CAAC,CAAC,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,6CAA6C;AAChI,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,YAAY,GAAG,GAAG;AACpB,QAAI,CAAC,YAAY,GAAG,EAAG,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,4CAA4C;AACjH,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,iBAAiB,GAAG,GAAG;AACzB,QAAI,CAAC,iBAAiB,GAAG,EAAG,IAAI,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,GAAG,GAAG,iCAAiC;AAC3G,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,qBAAqB,IAAI,GAAG,GAAG;AACjC,QAAI,KAAK,KAAK,CAAC,MAAM,CAAC,EAAE,WAAW,GAAG,KAAK,MAAM,WAAW,EAAG,QAAO,EAAE,SAAS,OAAO,QAAQ,kCAAkC;AAClI,WAAO,EAAE,SAAS,KAAK;AAAA,EACzB;AACA,MAAI,kBAAkB,IAAI,GAAG,EAAG,QAAO,EAAE,SAAS,KAAK;AACvD,MAAI,iBAAiB,IAAI,GAAG,EAAG,QAAO,EAAE,SAAS,KAAK;AAGtD,MAAI,IAAI,SAAS,GAAG,KAAK,gBAAgB,KAAK,GAAG,GAAG;AAClD,UAAM,OAAO,IAAI,MAAM,GAAG,EAAE,CAAC;AAC7B,QAAI,kBAAkB,IAAI,IAAI,EAAG,QAAO,EAAE,SAAS,KAAK;AACxD,WAAO,EAAE,SAAS,OAAO,QAAQ,oCAAoC,GAAG,GAAG;AAAA,EAC7E;AAEA,SAAO,EAAE,SAAS,OAAO,QAAQ,uCAAuC,GAAG,GAAG;AAChF;;;AClSA,IAAI,cAAc;AAEX,SAAS,WAAW,GAAkB;AAC3C,gBAAc;AAChB;AAEO,SAAS,IAAI,OAAiB,SAAiB,SAAyC;AAC7F,MAAI,UAAU,WAAW,CAAC,YAAa;AAEvC,QAAM,QAAkB;AAAA,IACtB,YAAW,oBAAI,KAAK,GAAE,YAAY;AAAA,IAClC;AAAA,IACA;AAAA,IACA,GAAI,WAAW,OAAO,KAAK,OAAO,EAAE,SAAS,IAAI,EAAE,QAAQ,IAAI,CAAC;AAAA,EAClE;AACA,UAAQ,OAAO,MAAM,KAAK,UAAU,KAAK,IAAI,IAAI;AACnD;AAEO,SAAS,SAAS,SAAiB,SAAyC;AACjF,MAAI,SAAS,SAAS,OAAO;AAC/B;AAEO,SAAS,QAAQ,SAAiB,SAAyC;AAChF,MAAI,QAAQ,SAAS,OAAO;AAC9B;AAEO,SAAS,QAAQ,SAAiB,SAAyC;AAChF,MAAI,QAAQ,SAAS,OAAO;AAC9B;AAEO,SAAS,SAAS,SAAiB,SAAyC;AACjF,MAAI,SAAS,SAAS,OAAO;AAC/B;;;AF7BO,IAAM,WAAqB,QAAQ;AACnC,IAAM,SAAS,aAAa;AAC5B,IAAM,SAAS,aAAa;AAC5B,IAAM,WAAW,aAAa;AAC9B,IAAM,OAAO,QAAQ;AAKrB,SAAS,WAAmB;AACjC,MAAI;AACF,UAAM,IAAI,WAAW;AACrB,WAAO,KAAK,EAAE,KAAK,IAAI,EAAE,KAAK,IAAI;AAAA,EACpC,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGO,SAAS,SAAiB;AAC/B,MAAI;AACF,UAAM,IAAI,SAAS,EAAE;AACrB,QAAI,KAAK,EAAE,KAAK,EAAG,QAAO,EAAE,KAAK;AAAA,EACnC,QAAQ;AAAA,EAER;AACA,SAAO,QAAQ,IAAI,QAAQ,QAAQ,IAAI,YAAY;AACrD;AAGA,IAAI;AAUG,SAAS,YAAoB;AAClC,MAAI,WAAY,QAAO;AACvB,QAAM,MAAM,KAAK,MAAM,cAAc;AACrC,QAAM,OAAO,KAAK,KAAK,YAAY;AACnC,MAAI;AACF,QAAI,WAAW,IAAI,GAAG;AACpB,YAAM,IAAI,aAAa,MAAM,MAAM,EAAE,KAAK;AAC1C,UAAI,EAAG,QAAQ,aAAa;AAAA,IAC9B;AACA,cAAU,KAAK,EAAE,WAAW,KAAK,CAAC;AAClC,UAAM,KAAK,WAAW;AACtB,kBAAc,MAAM,IAAI,EAAE,MAAM,IAAM,CAAC;AACvC,WAAQ,aAAa;AAAA,EACvB,SAAS,KAAK;AACZ,YAAQ,iDAAiD,eAAe,QAAQ,IAAI,UAAU,OAAO,GAAG,CAAC,EAAE;AAC3G,WAAQ,aAAa,WAAW;AAAA,EAClC;AACF;AASO,SAAS,gBAAwB;AACtC,MAAI,CAAC,OAAQ,QAAO;AAEpB,MAAI;AACF,aAAS,iBAAiB,EAAE,OAAO,QAAQ,SAAS,IAAK,CAAC;AAC1D,WAAO;AAAA,EACT,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AAGA,IAAI;AACG,SAAS,WAAmB;AACjC,MAAI,CAAC,OAAQ,UAAS,cAAc;AACpC,SAAO;AACT;AAcA,IAAM,gBAAgB;AAAA,EACpB;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAQ;AAAA,EAAU;AAAA,EAAQ;AAAA,EAClD;AAAA,EAAe;AAAA,EAAgB;AAAA,EAAW;AAAA,EAC1C;AAAA,EAAmB;AAAA,EAAiB;AAAA,EACpC;AAAA,EAAsB;AAAA,EAAe;AAAA,EACrC;AAAA,EAAc;AAAA,EACd;AACF;AAEO,SAAS,UAA6B;AAC3C,QAAM,MAAyB,CAAC;AAChC,aAAW,OAAO,eAAe;AAC/B,QAAI,QAAQ,IAAI,GAAG,EAAG,KAAI,GAAG,IAAI,QAAQ,IAAI,GAAG;AAAA,EAClD;AACA,SAAO;AACT;AAEO,SAAS,IAAI,KAAa,OAAmB,CAAC,GAAW;AAG9D,QAAM,SAAS,cAAc,KAAK,EAAE,OAAO,SAAS,eAAe,QAAQ,CAAC;AAC5E,MAAI,CAAC,OAAO,SAAS;AACnB,YAAQ,kCAAkC,OAAO,MAAM,EAAE;AACzD,WAAO;AAAA,EACT;AACA,MAAI;AACF,WAAO,SAAS,KAAK;AAAA,MACnB,OAAO;AAAA,MACP,SAAS,KAAK,WAAW;AAAA,MACzB,OAAO,SAAS;AAAA,MAChB,KAAK,KAAK,OAAO,QAAQ;AAAA,IAC3B,CAAC,EAAE,SAAS,EAAE,KAAK;AAAA,EACrB,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,cAAc,KAAqB;AACjD,MAAI,QAAQ;AACV,UAAM,IAAI,IAAI,eAAe,GAAG,yEAAyE,EAAE,SAAS,IAAK,CAAC;AAC1H,WAAO;AAAA,EACT;AACA,SAAO,IAAI,SAAS,GAAG,cAAc;AACvC;AAgBO,SAAS,cAAsB;AACpC,MAAI,OAAQ,QAAO,QAAQ,IAAI,WAAW,KAAK,MAAM,WAAW,SAAS;AACzE,MAAI,OAAQ,QAAO,KAAK,MAAM,WAAW,qBAAqB;AAC9D,SAAO,QAAQ,IAAI,iBAAiB,KAAK,MAAM,UAAU,OAAO;AAClE;AAaO,SAAS,mBAAiC;AAC/C,MAAI,QAAQ;AACV,UAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,MAAM,WAAW,OAAO;AACvE,WAAO;AAAA,MACL,QAAU,KAAK,OAAO,UAAU,UAAU,WAAW;AAAA,MACrD,UAAU,KAAK,OAAO,YAAY,WAAW;AAAA,MAC7C,MAAU,KAAK,OAAO,aAAa,QAAQ,WAAW;AAAA,MACtD,OAAU,KAAK,OAAO,iBAAiB,iBAAiB,WAAW;AAAA,MACnE,SAAU,KAAK,OAAO,WAAW,WAAW;AAAA,MAC5C,OAAU,KAAK,YAAY,GAAG,kBAAkB,cAAc;AAAA,IAChE;AAAA,EACF;AACA,MAAI,QAAQ;AACV,UAAM,MAAM,KAAK,MAAM,WAAW,qBAAqB;AACvD,WAAO;AAAA,MACL,QAAU,KAAK,KAAK,UAAU,QAAQ;AAAA,MACtC,UAAU,KAAK,KAAK,UAAU;AAAA,MAC9B,MAAU,KAAK,KAAK,gBAAgB;AAAA,MACpC,OAAU,KAAK,KAAK,iBAAiB,eAAe;AAAA,MACpD,SAAU,KAAK,KAAK,SAAS;AAAA,MAC7B,OAAU,KAAK,KAAK,yBAAyB;AAAA,IAC/C;AAAA,EACF;AAEA,SAAO;AAAA,IACL,QAAU,KAAK,MAAM,WAAW,eAAe;AAAA,IAC/C,UAAU,KAAK,MAAM,WAAW,UAAU;AAAA,IAC1C,MAAU,KAAK,MAAM,WAAW,gBAAgB;AAAA,IAChD,OAAU,KAAK,MAAM,WAAW,iBAAiB,eAAe;AAAA,IAChE,SAAU,KAAK,MAAM,WAAW,SAAS;AAAA,IACzC,OAAU,KAAK,MAAM,WAAW,OAAO;AAAA,EACzC;AACF;AAGO,SAAS,kBAA4B;AAC1C,MAAI,QAAQ;AACV,UAAM,UAAU,QAAQ,IAAI,WAAW,KAAK,MAAM,WAAW,SAAS;AACtE,WAAO,CAAC,KAAK,SAAS,WAAW,WAAW,UAAU,CAAC;AAAA,EACzD;AACA,MAAI,QAAQ;AACV,WAAO,CAAC,KAAK,MAAM,WAAW,uBAAuB,WAAW,UAAU,CAAC;AAAA,EAC7E;AAEA,SAAO;AAAA,IACL,KAAK,MAAM,YAAY,SAAS;AAAA,IAChC,KAAK,MAAM,QAAQ,WAAW,UAAU,YAAY,SAAS;AAAA,IAC7D,KAAK,MAAM,QAAQ,OAAO,uBAAuB,YAAY,SAAS;AAAA,EACxE;AACF;AAKO,SAAS,aAAuB;AACrC,QAAM,OAAiB,CAAC;AACxB,MAAI,QAAQ;AACV,UAAM,QAAQ,QAAQ,IAAI,gBAAgB,KAAK,MAAM,WAAW,OAAO;AACvE,UAAM,UAAU,QAAQ,IAAI,WAAW,KAAK,MAAM,WAAW,SAAS;AACtE,SAAK,KAAK,OAAO,OAAO;AACxB,UAAM,KAAK,KAAK,MAAM,WAAW,SAAS,UAAU;AACpD,QAAI,WAAW,EAAE,EAAG,MAAK,KAAK,EAAE;AAAA,EAClC,WAAW,QAAQ;AACjB,SAAK,KAAK,KAAK,MAAM,WAAW,qBAAqB,CAAC;AACtD,QAAI,WAAW,UAAU,EAAG,MAAK,KAAK,UAAU;AAAA,EAClD,OAAO;AACL,UAAM,YAAY,KAAK,MAAM,SAAS;AACtC,UAAM,UAAU,KAAK,MAAM,UAAU,OAAO;AAC5C,QAAI,WAAW,SAAS,EAAG,MAAK,KAAK,SAAS;AAC9C,QAAI,WAAW,OAAO,EAAG,MAAK,KAAK,OAAO;AAC1C,QAAI,WAAW,UAAU,EAAG,MAAK,KAAK,UAAU;AAAA,EAClD;AACA,SAAO,KAAK,OAAO,OAAK,WAAW,CAAC,CAAC;AACvC;AASO,SAAS,UAAU,MAAgB,UAAoB,UAAkB,OAAuB;AACrG,MAAI,KAAK,WAAW,EAAG,QAAO;AAC9B,MAAI,QAAQ;AACV,UAAM,WAAW,SAAS,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG;AACrD,UAAM,WAAW,KAAK,IAAI,OAAK,IAAI,CAAC,GAAG,EAAE,KAAK,GAAG;AACjD,WAAO;AAAA,MACL,uBAAuB,QAAQ,oBAAoB,QAAQ,aAAa,QAAQ,yDAAyD,KAAK;AAAA,MAC9I,EAAE,SAAS,KAAO;AAAA,IACpB;AAAA,EACF;AACA,QAAM,WAAW,SAAS,IAAI,OAAK,UAAU,CAAC,GAAG,EAAE,KAAK,MAAM;AAC9D,QAAM,WAAW,KAAK,IAAI,OAAK,SAAS,CAAC,eAAe,QAAQ,QAAQ,QAAQ,kBAAkB,EAAE,KAAK,IAAI;AAC7G,SAAO,IAAI,KAAK,QAAQ,eAAe,KAAK,IAAI,EAAE,SAAS,KAAO,CAAC;AACrE;AAKO,SAAS,qBAA6B;AAC3C,MAAI,QAAQ;AAEV,WAAO;AAAA,MACL;AAAA,MAIA,EAAE,SAAS,KAAO;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAQ;AAEV,WAAO,IAAI,+FAA+F,EAAE,SAAS,KAAO,CAAC;AAAA,EAC/H;AAEA,SAAO,IAAI,wBAAwB,EAAE,SAAS,IAAO,CAAC;AACxD;AAQO,SAAS,6BAAqC;AACnD,MAAI,QAAQ;AACV,WAAO;AAAA,MACL;AAAA,MAGA,EAAE,SAAS,KAAO;AAAA,IACpB;AAAA,EACF;AACA,MAAI,QAAQ;AACV,WAAO,IAAI,gDAAgD,EAAE,SAAS,KAAO,CAAC;AAAA,EAChF;AACA,SAAO,IAAI,yCAAyC,EAAE,SAAS,IAAO,CAAC;AACzE;AAgBO,SAAS,sBAA8B;AAC5C,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL;AAAA,IASA,EAAE,SAAS,IAAO;AAAA,EACpB;AACF;AAGO,SAAS,wBAAgC;AAC9C,MAAI,CAAC,OAAQ,QAAO;AACpB,SAAO;AAAA,IACL;AAAA,IAGA,EAAE,SAAS,IAAO;AAAA,EACpB;AACF;;;AD9WO,SAAS,mBAA2B;AACzC,MAAI,UAAU;AACd,QAAM,MAAM,OAAO;AACnB,MAAI;AACF,eAAW,KAAK,YAAY,GAAG,GAAG;AAChC,UAAI,EAAE,WAAW,aAAa,KAAK,EAAE,SAAS,SAAS,GAAG;AACxD,YAAI;AACF,qBAAWC,MAAK,KAAK,CAAC,CAAC;AACvB;AAAA,QACF,QAAQ;AAAA,QAAoC;AAAA,MAC9C;AAAA,IACF;AAAA,EACF,QAAQ;AAAA,EAA4B;AACpC,SAAO;AACT;AAiBO,SAAS,YAAY,QAAgB,QAAqC;AAC/E,MAAI;AACF,UAAM,IAAI,IAAI,IAAI,MAAM;AACxB,QAAI,EAAE,aAAa,WAAW,EAAE,aAAa,SAAU,QAAO;AAC9D,UAAM,WAAW,EAAE,aAAa,WAAW,UAAmB;AAE9D,UAAM,OAAO,EAAE,OAAO,SAAS,EAAE,MAAM,EAAE,IAAK,aAAa,UAAU,MAAM;AAC3E,UAAMC,YAAW,EAAE,SAAS,YAAY;AACxC,QAAI,CAACA,aAAYA,cAAa,eAAeA,cAAa,YAAa,QAAO;AAC9E,WAAO,EAAE,UAAAA,WAAU,MAAM,UAAU,OAAO;AAAA,EAC5C,QAAQ;AACN,WAAO;AAAA,EACT;AACF;AASO,SAAS,WAAW,MAAkB,QAAgB,KAA2B;AACtF,MAAI,KAAK,SAAS,SAAS,KAAK,KAAK;AACnC,UAAM,IAAI,YAAY,KAAK,KAAK,MAAM;AACtC,QAAI,EAAG,KAAI,KAAK,CAAC;AAAA,EACnB;AACA,MAAI,KAAK,UAAU;AACjB,eAAW,SAAS,KAAK,SAAU,YAAW,OAAO,QAAQ,GAAG;AAAA,EAClE;AACF;AAEO,SAAS,eAAe,UAAkB,QAAgC;AAC/E,MAAI,CAACC,YAAW,QAAQ,EAAG,QAAO,CAAC;AACnC,MAAI;AACF,UAAM,MAAM,KAAK,MAAMC,cAAa,UAAU,MAAM,CAAC;AAGrD,UAAM,MAAsB,CAAC;AAC7B,eAAW,QAAQ,OAAO,OAAO,IAAI,KAAK,GAAG;AAC3C,UAAI,KAAM,YAAW,MAAM,QAAQ,GAAG;AAAA,IACxC;AACA,WAAO;AAAA,EACT,QAAQ;AACN,WAAO,CAAC;AAAA,EACV;AACF;AAEA,eAAe,eAAkB,SAAiB,WAAmB,OAA6B;AAChG,MAAI,CAACD,YAAW,OAAO,EAAG,QAAO,CAAC;AAClC,QAAM,MAAMF,MAAK,OAAO,GAAG,cAAc,SAAS,IAAI,KAAK,IAAI,CAAC,SAAS;AACzE,MAAI;AACF,iBAAa,SAAS,GAAG;AACzB,UAAM,EAAE,SAAS,SAAS,IAAI,MAAM,OAAO,gBAAgB;AAC3D,UAAM,KAAK,IAAI,SAAS,KAAK,EAAE,UAAU,MAAM,eAAe,KAAK,CAAC;AACpE,QAAI;AACF,aAAO,GAAG,QAAQ,KAAK,EAAE,IAAI;AAAA,IAC/B,UAAE;AACA,SAAG,MAAM;AAAA,IACX;AAAA,EACF,QAAQ;AACN,WAAO,CAAC;AAAA,EACV,UAAE;AACA,QAAI;AAAE,iBAAW,GAAG;AAAA,IAAG,QAAQ;AAAA,IAAe;AAAA,EAChD;AACF;AAEA,eAAsB,qBAAqB,YAA6C;AACtF,QAAM,OAAO,MAAM;AAAA,IACjBA,MAAK,YAAY,eAAe;AAAA,IAAG;AAAA,IACnC;AAAA;AAAA;AAAA,EAGF;AACA,SAAO,KAAK,IAAI,OAAK,YAAY,EAAE,KAAK,SAAS,CAAC,EAAE,OAAO,CAAC,MAAyB,MAAM,IAAI;AACjG;AAEA,eAAsB,mBAAmB,YAA4C;AACnF,QAAM,OAAO,MAAM;AAAA,IACjBA,MAAK,YAAY,eAAe;AAAA,IAAG;AAAA,IACnC;AAAA;AAAA;AAAA,EAGF;AACA,SAAO,KACJ,IAAI,OAAK;AACR,UAAM,IAAI,YAAY,EAAE,KAAK,SAAS;AACtC,WAAO,IAAI,EAAE,GAAG,GAAG,YAAY,EAAE,YAAY,IAAI;AAAA,EACnD,CAAC,EACA,OAAO,CAAC,MAAwB,MAAM,IAAI;AAC/C;AAEA,eAAsB,oBAAoB,aAAqB,QAAwC;AACrG,QAAM,OAAO,MAAM;AAAA,IACjB;AAAA,IAAa;AAAA,IACb;AAAA;AAAA;AAAA,EAGF;AACA,SAAO,KACJ,IAAI,OAAK;AACR,UAAM,IAAI,YAAY,EAAE,KAAK,MAAM;AACnC,WAAO,IAAI,EAAE,GAAG,GAAG,YAAY,EAAE,YAAY,IAAI;AAAA,EACnD,CAAC,EACA,OAAO,CAAC,MAAwB,MAAM,IAAI;AAC/C;AAKA,IAAMI,YAAW,CAAC,UAAU,CAAC;AAGtB,SAAS,gBAAgB,MAAwB;AACtD,QAAM,QAAkB,CAAC;AACzB,QAAM,cAAcJ,MAAK,MAAM,WAAW,WAAW;AACrD,MAAIE,YAAW,WAAW,EAAG,OAAM,KAAK,WAAW;AAEnD,MAAIA,YAAW,IAAI,GAAG;AACpB,QAAI;AACF,iBAAW,SAAS,YAAY,IAAI,GAAG;AACrC,YAAI,MAAM,WAAW,UAAU,GAAG;AAChC,gBAAM,IAAIF,MAAK,MAAM,OAAO,WAAW;AACvC,cAAIE,YAAW,CAAC,EAAG,OAAM,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAe;AAAA,EACzB;AACA,SAAO;AACT;AAEO,SAAS,uBAAuB,MAAwB;AAC7D,QAAM,QAAkB,CAAC;AACzB,QAAM,cAAcF,MAAK,MAAM,WAAW,SAAS;AACnD,MAAIE,YAAW,WAAW,EAAG,OAAM,KAAK,WAAW;AACnD,MAAIA,YAAW,IAAI,GAAG;AACpB,QAAI;AACF,iBAAW,SAAS,YAAY,IAAI,GAAG;AACrC,YAAI,MAAM,WAAW,UAAU,GAAG;AAChC,gBAAM,IAAIF,MAAK,MAAM,OAAO,SAAS;AACrC,cAAIE,YAAW,CAAC,EAAG,OAAM,KAAK,CAAC;AAAA,QACjC;AAAA,MACF;AAAA,IACF,QAAQ;AAAA,IAAe;AAAA,EACzB;AACA,SAAO;AACT;AAGA,IAAM,gBAAgB,iBAAiB;AAEvC,IAAM,cAAc,cAAc;AAClC,IAAM,gBAAgB,cAAc;AACpC,IAAM,YAAY,cAAc;AAChC,IAAM,aAAa,cAAc;AACjC,IAAM,eAAe,cAAc;AACnC,IAAM,aAAa,cAAc;AAGjC,IAAM,qBAAqBF,MAAK,MAAM,QAAQ,YAAY,UAAU,UAAU;AAC9E,IAAM,wBAAwBA,MAAK,MAAM,QAAQ,OAAO,yBAAyB,UAAU,UAAU;AACrG,IAAM,sBAAsBA,MAAK,MAAM,QAAQ,OAAO,qBAAqB,UAAU,eAAe;AACpG,IAAM,qBAAqBA,MAAK,MAAM,QAAQ,OAAO,qBAAqB,UAAU,iBAAiB,eAAe;AACpH,IAAM,oBAAoBA,MAAK,MAAM,QAAQ,OAAO,sBAAsB,UAAU,gBAAgB;AAEpG,SAAS,qBAA+B;AACtC,QAAM,QAAQ,gBAAgB;AAC9B,QAAM,OAAiB,CAAC;AACxB,aAAW,QAAQ,OAAO;AACxB,QAAI,CAACE,YAAW,IAAI,EAAG;AACvB,QAAI;AACF,iBAAW,KAAK,YAAY,IAAI,GAAG;AACjC,cAAM,OAAOF,MAAK,MAAM,CAAC;AACzB,YAAI;AACF,cAAI,SAAS,IAAI,EAAE,YAAY,KAAKE,YAAWF,MAAK,MAAM,eAAe,CAAC,GAAG;AAC3E,iBAAK,KAAK,IAAI;AAAA,UAChB;AAAA,QACF,QAAQ;AAAA,QAAe;AAAA,MACzB;AAAA,IACF,QAAQ;AAAA,IAAe;AAAA,EACzB;AACA,SAAO;AACT;AAIA,eAAsB,mBAA4C;AAChE,QAAM,MAAsB,CAAC;AAG7B,aAAW,KAAK,gBAAgB,WAAW,EAAK,KAAI,KAAK,GAAG,eAAe,GAAG,QAAQ,CAAC;AACvF,aAAW,KAAK,gBAAgB,aAAa,EAAG,KAAI,KAAK,GAAG,eAAe,GAAG,UAAU,CAAC;AACzF,aAAW,KAAK,gBAAgB,SAAS,EAAO,KAAI,KAAK,GAAG,eAAe,GAAG,MAAM,CAAC;AACrF,aAAW,KAAK,gBAAgB,UAAU,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,OAAO,CAAC;AACtF,aAAW,KAAK,gBAAgB,YAAY,EAAI,KAAI,KAAK,GAAG,eAAe,GAAG,SAAS,CAAC;AACxF,aAAW,KAAK,gBAAgB,UAAU,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,OAAO,CAAC;AAGtF,MAAII,WAAU;AACZ,eAAW,KAAK,gBAAgB,kBAAkB,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,eAAe,CAAC;AACtG,eAAW,KAAK,gBAAgB,qBAAqB,EAAG,KAAI,KAAK,GAAG,eAAe,GAAG,kBAAkB,CAAC;AACzG,eAAW,KAAK,gBAAgB,mBAAmB,EAAK,KAAI,KAAK,GAAG,eAAe,GAAG,gBAAgB,CAAC;AACvG,eAAW,KAAK,gBAAgB,kBAAkB,EAAM,KAAI,KAAK,GAAG,eAAe,GAAG,eAAe,CAAC;AACtG,eAAW,KAAK,gBAAgB,iBAAiB,EAAO,KAAI,KAAK,GAAG,eAAe,GAAG,cAAc,CAAC;AAAA,EACvG;AAGA,aAAW,OAAO,mBAAmB,GAAG;AACtC,QAAI,KAAK,GAAG,MAAM,qBAAqB,GAAG,CAAC;AAAA,EAC7C;AAGA,QAAM,OAAO,oBAAI,IAAY;AAC7B,SAAO,IAAI,OAAO,OAAK;AACrB,QAAI,KAAK,IAAI,EAAE,QAAQ,EAAG,QAAO;AACjC,SAAK,IAAI,EAAE,QAAQ;AACnB,WAAO;AAAA,EACT,CAAC;AACH;AAEA,eAAsB,iBAAyC;AAC7D,QAAM,MAAqB,CAAC;AAG5B,aAAW,KAAK,uBAAuB,WAAW,EAAK,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,QAAQ,CAAC;AACzG,aAAW,KAAK,uBAAuB,aAAa,EAAG,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,UAAU,CAAC;AAC3G,aAAW,KAAK,uBAAuB,SAAS,EAAO,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,MAAM,CAAC;AACvG,aAAW,KAAK,uBAAuB,UAAU,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AACxG,aAAW,KAAK,uBAAuB,YAAY,EAAI,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,SAAS,CAAC;AAC1G,aAAW,KAAK,uBAAuB,UAAU,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,OAAO,CAAC;AAGxG,MAAIA,WAAU;AACZ,eAAW,KAAK,uBAAuB,kBAAkB,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACxH,eAAW,KAAK,uBAAuB,qBAAqB,EAAG,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,kBAAkB,CAAC;AAC3H,eAAW,KAAK,uBAAuB,mBAAmB,EAAK,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,gBAAgB,CAAC;AACzH,eAAW,KAAK,uBAAuB,kBAAkB,EAAM,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,eAAe,CAAC;AACxH,eAAW,KAAK,uBAAuB,iBAAiB,EAAO,KAAI,KAAK,GAAG,MAAM,oBAAoB,GAAG,cAAc,CAAC;AAAA,EACzH;AAGA,aAAW,OAAO,mBAAmB,GAAG;AACtC,QAAI,KAAK,GAAG,MAAM,mBAAmB,GAAG,CAAC;AAAA,EAC3C;AAGA,QAAM,SAAS,oBAAI,IAAyB;AAC5C,aAAW,KAAK,KAAK;AACnB,UAAM,WAAW,OAAO,IAAI,EAAE,QAAQ;AACtC,QAAI,UAAU;AACZ,eAAS,cAAc,EAAE;AAAA,IAC3B,OAAO;AACL,aAAO,IAAI,EAAE,UAAU,EAAE,GAAG,EAAE,CAAC;AAAA,IACjC;AAAA,EACF;AAGA,SAAO,CAAC,GAAG,OAAO,OAAO,CAAC,EAAE,KAAK,CAAC,GAAG,MAAM,EAAE,aAAa,EAAE,UAAU;AACxE;","names":["existsSync","readFileSync","join","join","hostname","existsSync","readFileSync","IS_LINUX"]}